Create a feed from a file to manage your threat intelligence data. Use a file if you have simple analysis requirements or quick reference needs, or if you need to integrate with tools that support direct file imports.
You can create a feed from the following file types:
- CSV: File for sharing data and storing data.
- JSON: Text-based file format that stores and exchanges data.
- TXT: Plain text file that stores unformatted text.
- STIX: File that uses Structured Threat Information eXpression (STIX) language to share cyber threat intelligence (CTI).
Important!: You must ensure that the columns in your file correspond to the data that is represented.
The benefits of using a file to create a feed are:
- Historical analysis: Convenient method to store historical threat data that allows users to investigate trends, attack behaviors, and evolving threats.
- Predefined datasets: Pre-defined datasets like malware samples or lists of IP addresses that can be used to analyze industry regulations.
- Offline data: Offline data that users can use in scenarios where internet access is limited or unavailable.
To create a feed from a file, complete the following process:
Create a feed from a file
- From the home page, select Threat intelligence management and then select All Feeds.
- Select Create New Feed, and then select From File.
- In the Feed name box, enter the name of your feed.
- From the Feed type box, select your feed type.
- (Optional) In the Vendor box, enter the name of the vendor.
- (Optional) In the Source Score (0-100) box, enter a source score for the feed.
- (Optional) In the Description box, enter a Description of the feed.
- (Optional) Select** + Add Tag** to add a custom tag to help you identify observables across multiple feeds.
- Select Select a File and upload your file.
- Select Create.